Ethical Hacking Chapter 10

If a Web server isn't protected, an attacker can gain access through remote administration interfaces. True or False?

True

What tags identify ColdFusion as the scripting language?

the letters CF

The AccessFileName directive in Apache, along with a configuration file (such as .htaccess), can be used to perform which of the following on a Web site?

Restrict directory access to those with authorized user credentials.

Entering the value ' OR 1=1 in a Web application that has an "Enter Your PIN" field is most likely an example of which attack?

SQL injection

What tag is used to indicate ASP code?

<% %>

What tags identify PHP as the scripting language?

<? ?>

Which of the following is used to connect an ASP Web page to an Oracle database? (Choose all that apply.)

ADO OLE DB

The following code is an example of what language?

ASP

HTML Web pages containing connection strings are more vulnerable to attack. True or False?

True

Which of the following can be used to create dynamic Web pages? (Choose all that apply.)

ColdFusion PHP ASP

Name three Web application vulnerabilities from OWASP's top 10 list.

Correct answers include cross-site scripting (XSS) flaws, injection flaws, malicious file execution, unsecured direct object reference, cross-site request forgery (CSRF), information leakage and incorrect error handling, broken authentication and session management, unsecured cryptographic storage, unsecured communication, and failure to restrict URL access.

Which of the following can be used to connect a Web server to a back-end database server? (Choose all that apply.)

ODBC OLE ADO

List an organization with online resources for learning more about Web application vulnerabilities.

Open Web Application Security Project (OWASP)

Which of the following is an open-source technology for creating dynamic HTML Web pages?

PHP

An HTML Web page containing ASP code must be compiled before running. True or False?

False

CGI is used in Microsoft ASP pages. True or False?

False

IIS is used on more than twice as many Web servers as Apache Web Server. True or False?

False

What's the default Web server in Windows Vista?

IIS 7.0

Entering the URL http://www.abc.com/%55/%55/%55/%55/%55 in a Web browser is an example of what exploit?

Unicode exploit

Which of the following can be used to detect a new application vulnerability on a Web site?

Wapiti